Download & Extend

User reference overrides all other permissions

Project:Node access user reference
Version:6.x-2.5
Component:Code
Category:support request
Priority:normal
Assigned:Unassigned
Status:closed (fixed)

Issue Summary

I have nodeaccess_userreference as the only access control module on my site. When I set up the module to operate on a node, it either disallows everyone from all perms aside from those in the list, or it has no effect.

I have a node with a user reference field, and I want those in the field to edit the node. My field only has "Grant edit access" checked for the na_ur field-specific settings.

0 or higher: disallow all perms for everyone except those permissions explicitly marked as enabled in the field settings and added to the field.
devel node access shows 3 access entries, all from the realm "nodeaccess_userreference". All 3 have view and update, but not delete.
The only way for a user to have any permission on this node is for them to be added to the user reference field, AND for this field to have the relevant permission grant enabled.

less than 0: No effect on permissions.
access entries:
nodeaccess_author (gid 1) view update delete
nodeaccess_rid (gid 1) view
nodeaccess_rid (gid 2) view

Comments

#1

Title:User reference permissions "all or nothing"» User reference overrides all other permissions

#2

Status:active» fixed

I was misinterpreting the purpose of node access priority. I thought permissions were additive and the priority adjusted which were calculated first, and that I needed to change this in order to get na_userreference and na_nodereference to play nicely together.
The reason I initially thought this was that na_nr was not working to begin with even after permission rebuilds. Resubmitting the specific referencing content fixed this.

For anyone else who stumbles into this, the purpose of access priority seems to be controlling which modules have access over which node, not the order in which permissions are calculated. Because of this, modules must have the same priority to work in tandem with a node, else the lowest priority number will be the only access control applied.

#3

Status:fixed» closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

nobody click here